Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(30)

Side by Side Diff: sandbox/linux/seccomp-bpf-helpers/baseline_policy.h

Issue 681713002: Update from chromium https://crrev.com/301315 (Closed) Base URL: https://github.com/domokit/mojo.git@master
Patch Set: Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « sandbox/linux/sandbox_linux.gypi ('k') | sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
7 7
8 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" 8 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
9 #include "sandbox/linux/bpf_dsl/policy.h"
9 #include "sandbox/sandbox_export.h" 10 #include "sandbox/sandbox_export.h"
10 11
11 namespace sandbox { 12 namespace sandbox {
12 13
13 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox 14 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox
14 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't 15 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't
15 // have a clear semantics and is mostly "implementation-defined". 16 // have a clear semantics and is mostly "implementation-defined".
16 // 17 //
17 // This class implements the SandboxBPFDSLPolicy interface with a "baseline" 18 // This class implements the Policy interface with a "baseline"
18 // policy for use within Chromium. 19 // policy for use within Chromium.
19 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an 20 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an
20 // alteration of it, and it represents a reasonable common ground to run most 21 // alteration of it, and it represents a reasonable common ground to run most
21 // code in a sandboxed environment. 22 // code in a sandboxed environment.
22 // A baseline policy is only valid for the process for which this object was 23 // A baseline policy is only valid for the process for which this object was
23 // instantiated (so do not fork() and use it in a child). 24 // instantiated (so do not fork() and use it in a child).
24 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::SandboxBPFDSLPolicy { 25 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy {
25 public: 26 public:
26 BaselinePolicy(); 27 BaselinePolicy();
27 // |fs_denied_errno| is the errno returned when a filesystem access system 28 // |fs_denied_errno| is the errno returned when a filesystem access system
28 // call is denied. 29 // call is denied.
29 explicit BaselinePolicy(int fs_denied_errno); 30 explicit BaselinePolicy(int fs_denied_errno);
30 virtual ~BaselinePolicy(); 31 virtual ~BaselinePolicy();
31 32
32 virtual bpf_dsl::ResultExpr EvaluateSyscall( 33 virtual bpf_dsl::ResultExpr EvaluateSyscall(
33 int system_call_number) const override; 34 int system_call_number) const override;
34 virtual bpf_dsl::ResultExpr InvalidSyscall() const override; 35 virtual bpf_dsl::ResultExpr InvalidSyscall() const override;
35 pid_t policy_pid() const { return policy_pid_; } 36 pid_t policy_pid() const { return policy_pid_; }
36 37
37 private: 38 private:
38 int fs_denied_errno_; 39 int fs_denied_errno_;
39 40
40 // The PID that the policy applies to (should be equal to the current pid). 41 // The PID that the policy applies to (should be equal to the current pid).
41 pid_t policy_pid_; 42 pid_t policy_pid_;
42 43
43 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); 44 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy);
44 }; 45 };
45 46
46 } // namespace sandbox. 47 } // namespace sandbox.
47 48
48 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 49 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
OLDNEW
« no previous file with comments | « sandbox/linux/sandbox_linux.gypi ('k') | sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698